ASUS has patched a maximum-severity flaw in Control Center Enterprise (ACC), the fleet-management platform IT teams use to remotely monitor, configure, and patch servers, workstations, and PCs across an organization. CVE-2026-75754 carries a CVSS score of 10.0 and requires no credentials, no user interaction, and no prior access — an attacker who can reach the management console over the network walks away with a root shell on the box that controls everything else.

What happened

ACC’s design is the whole problem here: it’s a single console with privileged reach into every endpoint it manages, which makes any authentication gap in the server itself catastrophic. Researchers found three separate weaknesses chained into one exploit path:

  1. Missing authentication for a critical function — an endpoint on the ACC server responds to unauthenticated HTTP requests and hands back the instance’s internal encryption key.
  2. Server-side request forgery (SSRF) in the same request flow, which an attacker uses to reach an internal-only service that shouldn’t be reachable from outside.
  3. Hardcoded SSH credentials baked into the product. Retrieving the encryption key in step one causes a local service on the ACC host to enable SSH on port 2222; the attacker then authenticates with the hardcoded credentials and lands a root shell.

None of the three steps requires a login, a session token, or any interaction from an administrator. The entire chain runs over the network against however ACC is exposed — which, for a tool explicitly meant to sit on a management network and reach every managed endpoint, is often broader than intended.

Affected versions and patch

ASUS’s advisory (published September 4, 2026) covers ACC Enterprise builds up through 4.0.0.2. The vendor’s fixed release is 3.1.0.9 or later — a version-numbering gap that ASUS hasn’t clarified publicly, so if you’re unsure which track your deployment is on, don’t try to reason it out from the numbers: pull the latest installer directly from ASUS and compare against your running build. ASUS has not published a technical root-cause writeup or proof-of-concept, which is consistent with the vendor treating exploit details as sensitive given the severity.

Impact

Root on the ACC server isn’t the end state — it’s the pivot point. ACC Enterprise is built to reach into and control every server, PC, and workstation enrolled under it, so an attacker with root on the management box inherits:

  • Direct read, write, and delete access to any data stored or cached on the ACC server itself.
  • Remote control of every managed endpoint through ACC’s built-in management channels — the same functionality administrators use for patching and configuration push, now available to the attacker.
  • A durable foothold for lateral movement, since a fleet-management server sits, by necessity, on a trusted segment with reach to most of the estate.

This is the same pattern that made recent RMM-platform compromises (N-central, ScreenConnect) so damaging: the tool’s entire value proposition — centralized privileged access to everything it manages — is exactly what an attacker inherits once the server itself is popped.

Mitigation

  • Patch to ACC 3.1.0.9 or later immediately. This is an unauthenticated, network-reachable, CVSS 10.0 root compromise on a platform that by design has privileged reach across your fleet — treat it as an emergency change.
  • Block or firewall port 2222 on ACC servers as an immediate stopgap if you can’t patch right away; the exploit chain depends on that SSH listener being reachable.
  • Take ACC off any network segment reachable from untrusted zones. Management consoles like this should sit on an isolated management VLAN with tightly scoped access, not on general corporate networks.
  • Rotate credentials associated with the ACC install after patching, since the hardcoded SSH credentials are baked into the shipped software and can’t be meaningfully considered secret going forward.
  • Audit for prior compromise. Check ACC server logs for unexpected inbound connections on port 2222, unfamiliar SSH sessions, or requests to the vulnerable HTTP endpoint predating your patch, and review managed endpoints for signs of unauthorized configuration changes or software pushes originating from ACC.

No CISA KEV listing or confirmed in-the-wild exploitation had been reported at publication time, but a fully unauthenticated CVSS 10.0 chain against a privileged management platform is exactly the profile that gets weaponized fast once technical details circulate.